openldap-technical

openldap-technical@openldap.org

18 participants
9785 discussions

RES: Openldap 2.3.39 Password Policy
by Gustavo Mendes de Carvalho 15 May '08

15 May '08

Hi Venkata, Check where is your slapd binary. In this directory, you will see a libexec directory. Inside you can find ppolicy.la module. Execute a pwd command and put pwd output in your slapd.conf file Here is my slapd.conf file ####################################################################### # Global definitions ####################################################################### include /usr/local/ldap/servers/slapd/schema/core.schema include /usr/local/ldap/servers/slapd/schema/cosine.schema include /usr/local/ldap/servers/slapd/schema/inetorgperson.schema include /usr/local/ldap/servers/slapd/schema/misc.schema include /usr/local/ldap/servers/slapd/schema/nis.schema include /usr/local/ldap/servers/slapd/schema/ppolicy.schema pidfile /var/run/slapd.pid argsfile /var/run/slapd.args logfile /var/log/ldap.log loglevel 256 # Load dynamic backend modules: modulepath /usr/local/libexec/openldap ### moduleload back_ldap.la ### moduleload back_passwd.la moduleload accesslog.la ### moduleload pcache.la moduleload ppolicy.la moduleload unique.la ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "c=country" rootdn "cn=manager,c=country" rootpw {SSHA}password's hash directory /usr/local/var/openldap-data/ mode 0600 cachesize 1000000 checkpoint 256 60 overlay ppolicy ppolicy_default "cn=default,ou=policies,o=org,c=country" ####################################################################### # ACL's ####################################################################### access to attrs=userPassword by self write by anonymous auth by dn="cn=manager,c=country" write by * read access to * by self write by dn="cn=manager,c=country" write by * read ####################################################################### # Indexes ####################################################################### index objectClass eq,pres index uid,memberUid eq,pres,sub Another tip is remove your shadow parameters from your user accoount. I mean, when you create an account, unset shadow properties. Leave all shadow properties defined in ppolicy options. Check my user output dn: uid=sdanyluk,ou=orgunit,o=org,c=country objectClass: posixAccount objectClass: top objectClass: inetOrgPerson objectClass: person loginShell: /bin/bash givenName: Scott sn: Danyluk displayName: Scott Danyluk uid: sdanyluk homeDirectory: /home/sdanyluk cn: Scott Danyluk uidNumber: 14838 userPassword: xxxxxxxxxxxxxxxxxxxxxxx gidNumber: 25075 Regards --- Gustavo Mendes de Carvalho email: gmcarvalho(a)gmail.com ________________________________ De: Venkata Janardhana [mailto:avjana@gmail.com] Enviada em: quinta-feira, 15 de maio de 2008 13:51 Para: jarbas.junior(a)gmail.com; gmcarvalho(a)gmail.com Cc: openldap-technical(a)openldap.org Assunto: Openldap 2.3.39 Password Policy, Hello , I see the you had same issue for the openldap 2.3.39 password policy. I am struggling to get this working like anything. Could you please help me out in configuring password policy and change the user password. I have installed openldap 2.3.39 and ./configure --prefix=/usr/local \ --libexecdir=/usr/sbin \ --sysconfdir=/etc \ --localstatedir=/srv/ldap \ --disable-debug \ --enable-dynamic \ --enable-crypt \ --enable-modules \ --enable-rlookups \ --enable-backends \ --enable-overlays \ --disable-sql && make depend && make make test su root -c 'make install I cannot find modulepath /usr/lib/openldap moduleload ppolicy.la files. Here is my slapd.conf and ldap search file hese are the following slapd.conf file and ldapsearch output.. User can login to the ldap server for the first time and could change the password but cannot login with new password or old password. having hard time in getting password policy working. COuld you some pls help me out.. whats the wrong.. thanks in advance, # # See slapd.conf(5) for details on configuration options. # This file should NOT be world readable. # include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/ppolicy.schema # Define global ACLs to disable default read access. # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. #referral ldap://root.openldap.org pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args # Load dynamic backend modules: # modulepath /usr/local/libexec/openldap # moduleload back_bdb.la # moduleload back_ldap.la # moduleload back_ldbm.la # moduleload back_passwd.la # moduleload back_shell.la # Sample security restrictions # Require integrity protection (prevent hijacking) # Require 112-bit (3DES or better) encryption for updates # Require 63-bit encryption for simple bind # security ssf=1 update_ssf=112 simple_bind=64 # Sample access control policy: # Root DSE: allow anyone to read it # Subschema (sub)entry DSE: allow anyone to read it # Other DSEs: # Allow self write access # Allow authenticated users read access # Allow anonymous users to authenticate # Directives needed to implement policy: # access to dn.base="" by * read # access to dn.base="cn=Subschema" by * read # access to * # by self write # by users read # by anonymous auth # # if no access controls are present, the default policy # allows anyone and everyone to read anything but restricts # updates to rootdn. (e.g., "access to * by * read") # # rootdn can always read and write EVERYTHING! access to amdexrs=userPassword by self write by * auth access to * by * read ####################################################################### # BDB database definitions ####################################################################### database bdb suffix "dc=sales,dc=amdex,dc=com" rootdn "cn=Manager,dc=sales,dc=amdex,dc=com" # Cleartext passwords, especially for the rootdn, should # be avoid. See slappasswd(8) and slapd.conf(5) for details. # Use of strong authentication encouraged. rootpw secret # The database directory MUST exist prior to running slapd AND # should only be accessible by the slapd and slap tools. # Mode 700 recommended. directory /usr/local/var/openldap-data # Indices to maintain index objectClass eq ---------------------------------------------------------- [root@testserver06 openldap]# ldapsearch -x -b 'dc=sales,dc=amdex,dc=com' '(objectclass=*)' # extended LDIF # # LDAPv3 # base <dc=sales,dc=amdex,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # sales.amdex.com dn: dc=sales,dc=amdex,dc=com dc: sales objectClass: top objectClass: domain objectClass: domainRelatedObject associatedDomain: sales.amdex.com # People, sales.amdex.com dn: ou=People,dc=sales,dc=amdex,dc=com ou: People objectClass: top objectClass: organizationalUnit objectClass: domainRelatedObject associatedDomain: sales.amdex.com # Group, sales.amdex.com dn: ou=Group,dc=sales,dc=amdex,dc=com ou: Group objectClass: top objectClass: organizationalUnit objectClass: domainRelatedObject associatedDomain: sales.amdex.com # ja5199, Group, sales.amdex.com dn: cn=ja5199,ou=Group,dc=sales,dc=amdex,dc=com objectClass: posixGroup objectClass: top cn: ja5199 gidNumber: 609 # ja5199, People, sales.amdex.com dn: uid=ja5199,ou=People,dc=sales,dc=amdex,dc=com uid: ja5199 cn: Jana Avula givenName: Jana sn: Avula mail: ja5199(a)sales.amdex.com objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowLastChange: 14001 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 609 gidNumber: 609 homeDirectory: /home/ja5199 gecos: Jana Avula # Policies, sales.amdex.com dn: ou=Policies,dc=sales,dc=amdex,dc=com objectClass: top objectClass: organizationalUnit ou: Policies # default, Policies, sales.amdex.com dn: cn=default,ou=Policies,dc=sales,dc=amdex,dc=com objectClass: top objectClass: device objectClass: pwdPolicy cn: default pwdamdexribute: 2.5.4.35 pwdMaxAge: 15552000 pwdExpireWarning: 864000 pwdInHistory: 1 pwdCheckQuality: 0 pwdMinLength: 8 pwdMaxFailure: 4 pwdLockout: TRUE pwdLockoutDuration: 1920 pwdGraceAuthNLimit: 5 pwdFailureCountInterval: 0 pwdMustChange: TRUE pwdAllowUserChange: TRUE pwdSafeModify: TRUE # search result search: 2 result: 0 Success # numResponses: 8 # numEntries: 7

1 0

openldap and mysql authentication
by thom.laurent＠free.fr 15 May '08

15 May '08

Hi, I have a simple question... I want to use openldap as an address book, so it can be used with mail clients like thunderbird, outlook... I already have a mysql database to store users for my mail server, and I dont want to duplicate these informations. Can I use this sql database as a source for the openldap access control, or do I have to store all my users in the ldap ? This way I could authenticate using user accounts stored in the mysql database and keep all my contact informations in the ldap... Thanks for your answers!

2 1

"invalid structural object class chain"
by Karsten Kankowski 14 May '08

14 May '08

Dear wise guys! Sorry for a "newby" question: I would like to load following LDIF: dn: cn=Zaphod Beblebrox, ou=people,cu=user,cu=a-d,cu=natco,dc=cax,dc=airbus,dc=com cn: Zaphod Beblebrox objectClass:Top objectClass: Person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: account objectClass: posixAccount gidNumber: 42 homeDirectory: /home/ZZ-Plural-Z-Alpha userid:zaphod I get back: ldapadd: Object class violation (65) additional info: invalid structural object class chain (inetOrgPerson/account) I searched before I wrote this mal the Web/ the Forum / the FAQ / the admin-Guide :-) I found at the admin guide chapter C1.13 an description about this issue. BUT: I´m sorry! I don´t understand this real hard to read english. All what I hopfully know is, that a subsequent class of a Structural can be one or more auxiliary OR an other Structural. I assume that Top->Person->organizationalPerson->inetOrgperson "looks" like one structural class in case that they inherit via the SUP keyword ( called superclass ?? ) For that I do not understand why the account object class can´t be "connect" to that superclass. What´s wrong here and how do can I use the account as subsequent class of inetOrgPerson. The "connect" of posixAccount to account should be also possible. Thanks a lot for your help in advance, Karsten (Alien) -- //// Never forget your towel \\\\ *********************************************************** Karsten Kankowski on behalf of Computacenter Subcontractor for OADI Phone: +49 (0)40 743 74589 Fax: +49 (0)40 743 870 74589 Mailto:Karsten.Kankowski@airbus.com PgP-Key 0x754EEF1D ********************************************************** The information in this e-mail is confidential. The contents may not be disclosed or used by anyone other then the addressee. Access to this e-mail by anyone else is unauthorised. If you are not the intended recipient, please notify Airbus immediately and delete this e-mail. Airbus cannot accept any responsibility for the accuracy or completeness of this e-mail as it has been sent over public networks. If you have any concerns over the content of this message or its Accuracy or Integrity, please contact Airbus immediately. All outgoing e-mails from Airbus are checked using regularly updated virus scanning software but you should take whatever measures you deem to be appropriate to ensure that this message and any attachments are virus free.

2 1

password policy user configuration
by Gustavo Mendes de Carvalho 13 May '08

13 May '08

Hi there, I already compiled last openldap stable version with this commands # ./configure --program-prefix=/usr/local/ldap --enable-bdb --enable-modules --enable-overlays=yes --enable-backends=yes --disable-ipv6 --with-cyrus-sasl --with-tls --disable-sql # make depend; make; make install and after running make test command, I saw that everything was OK, so I can start slapd with ppolicy module included. When I include pwdPolicy objectclass in user configuration I can see several pwd parameters, but after set some values, I can't see this policy working. I mean, in my user bellow, I set "pwdInHistory = 6", but when I try to change their password, OpanLDAP do not check this value. Here is command used to change passwords ldappasswd -w test1234 -a test1234 -s 5432test -x -H ldap://192.168.248.164 -D uid=test,ou=orgunit,o=org ldappasswd -w 5432test -a 5432test -s test1234 -x -H ldap://192.168.248.164 -D uid=test,ou=orgunit,o=org I can execute this commands ad eternum, with no error messages from LDAP server telling me that my password is not OK. According with my configuration I would use 7 different passwords (6 in history +1 to change) And I can change this password faster than it expires (according with configuration bellow "pwdMinAge: 30" tells me to wait 30 seconds to change my password) User definition dn: uid=test,ou=orgunit,o=org objectClass: posixAccount objectClass: top objectClass: inetOrgPerson objectClass: shadowAccount objectClass: person objectClass: pwdPolicy loginShell: /bin/bash givenName: test sn: test-test displayName: test test-test uid: test homeDirectory: /home/test shadowFlag: 0 shadowMax: 35 shadowWarning: 7 shadowInactive: 99999 shadowExpire: 99999 cn: test test-test uidNumber: 12190 gidNumber: 25023 shadowMin: 10 pwdAttribute: userPassword pwdMinAge: 30 pwdMaxAge: 120 pwdInHistory: 3 pwdMinLength: 8 pwdExpireWarning: 60 pwdLockout: TRUE pwdLockoutDuration: 60 pwdMaxFailure: 2 pwdSafeModify: TRUE shadowLastChange: 14006 pwdMustChange: FALSE userPassword: {SSHA}XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Does anybody already uses this pwd definitions ann can explain me if is it OK ? I already read man 5 slapo-ppolicy and I already execute slapindex -v after insert this parameters either. Man 5 does explain all parameters, and I set up them according with man explanation, but it does no work. Thanks in advance --- Gustavo Mendes de Carvalho e-mail: gmcarvalho(a)gmail.com

3 5

LDAP server and Router Cisco VPN
by youness hsina 13 May '08

13 May '08

Hi all sorry for my english i have an ldap server and a router cisco vpn 3600 séries. i want to configure my router in order to use my ldapserver but i don't know how i cant do this. Have you any ideas please ? i join a picture of my network diagram. Regards, Uness

3 7

Just su doesn't work
by AlexanDER Franca 13 May '08

13 May '08

Hi. Sorry for my english... So... I have installed OpenLDAP and nss_ldap. I'm using Slackware 12. All works fine, I can search, add... getent works for passwd and group, etc. But if I run 'su - username', the 'username' is found but seems password never work. I receive a 'Sorry' from su. If I'm root and run 'su - username', all works fine... I become 'username' with my home directory, etc (id command show 'username' informations right too). It seems to be something with password configuration, but... I don't know... I have 3 or 4 users, all with the same password. I tried all of them, and... the same problem. I tried 3 "encryption" modes (md5, md5crypt and clear). I was change /etc/login.defs to disable MD5_CRYPT_ENABLE, enable again... and nothing works. /var/log/debug show no errors. I don't asking for a solution, just a way to still searching (I don't know where to go now). []'s Alexander Brazil - Rio de Janeiro

3 4

Re: Mystery - Authentication Would Fail If Not Binding With Server By Using cn=Manager
by Luke Lee 12 May '08

12 May '08

I just resolved the problem myself. I think the slapd was confused by some "commented out" access entries (access entries with a pound sign to being with). I removed those entries and the problem just went away. Thank you for taking time and trying to help. Luke ----- Original Message ---- From: Luke Lee <leeluke77(a)yahoo.com> To: Dieter Kluenter <dieter(a)dkluenter.de>; openldap-technical(a)openldap.org Sent: Monday, May 12, 2008 10:56:00 AM Subject: Mystery - Authentication Would Fail If Not Binding With Server By Using cn=Manager My access rules in the slapd..conf are the following: access to attrs=userPassword by self write by anonymous auth by dn.base="cn=sysadmin,dc=mydomain,dc=com" write by group.exact="cn=itmanager,ou=manager,dc=mydomain,dc=com" write by * none access to * by self write by dn.base="cn=sysadmin,dc=mydomain,dc=com" write by group.exact="cn=itmanager,ou=manager,dc=mydomain,dc=com" write by * read If I don't have the following entries in a client's /etc/ldap.conf, when I login the client by using ssh I will get the "Access denied" message: binddn cn=Manager,dc=mydomain,dc=com bindpw secret The ldap log is the following: May 11 16:08:18 ldapm slapd[24629]: conn=0 fd=13 ACCEPT from IP=192.168.2.161:33801 (IP=0.0.0.0:389) May 11 16:08:18 ldapm slapd[24629]: conn=0 op=0 BIND dn="" method=128 May 11 16:08:18 ldapm slapd[24629]: conn=0 op=0 RESULT tag=97 err=0 text= May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=1 fd=16 ACCEPT from IP=192.168.2.161:33802 (IP=0.0.0.0:389) May 11 16:08:23 ldapm slapd[24629]: conn=1 op=0 BIND dn="" method=128 May 11 16:08:23 ldapm slapd[24629]: conn=1 op=0 RESULT tag=97 err=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=1 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(uid=luke_l)" May 11 16:08:23 ldapm slapd[24629]: conn=1 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= If I have the binddn and bindpw using the distinguished name, Manager, the login will succeed. The ldap log is the following: May 11 17:22:32 ldapm slapd[24629]: conn=20 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=4 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(uid=luke_l)" May 11 17:22:32 ldapm slapd[24629]: conn=20 op=4 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(|(memberUid=luke_l)(uniqueMember=uid=luke_l,ou=people,dc=mydomain,dc=com)))" May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SRCH attr=cn userPassword memberUid uniqueMember gidNumber May 11 17:22:32 ldapm slapd[24629]: <= bdb_equality_candidates: (uniqueMember) not indexed May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=6 UNBIND May 11 17:22:32 ldapm slapd[24629]: conn=20 fd=18 closed May 11 17:22:32 ldapm slapd[24629]: conn=21 fd=16 ACCEPT from IP=192.168.2.161:33816 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=22 fd=18 ACCEPT from IP=192.168.2.161:33817 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 fd=20 ACCEPT from IP=192.168.2.161:33818 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 fd=20 closed (connection lost) What should I do to fix the problem and bind the server anonymously but get the authetication working? Thanks. Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Saturday, May 10, 2008 1:32:58 AM Subject: Re: Mystery - Authentication Would Fail If Not Binding With Server By Using cn=Manager Hi, Luke Lee <leeluke77(a)yahoo.com> writes: > I am running OpenLDAP 2.3.39 on RedHat. My login authentication on a client > system will fail if I don't configure the optional binddn and bindpw by using > cn=Manager. > > Can anyone please enlighten me what could cause the strange problem? Thanks! Could you be a bit more specific and could you provide the access rules of slapd.conf? -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6 ________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. ________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Mystery - Authentication Would Fail If Not Binding With Server By Using cn=Manager
by Luke Lee 12 May '08

12 May '08

My access rules in the slapd.conf are the following: access to attrs=userPassword by self write by anonymous auth by dn.base="cn=sysadmin,dc=mydomain,dc=com" write by group.exact="cn=itmanager,ou=manager,dc=mydomain,dc=com" write by * none access to * by self write by dn.base="cn=sysadmin,dc=mydomain,dc=com" write by group.exact="cn=itmanager,ou=manager,dc=mydomain,dc=com" write by * read If I don't have the following entries in a client's /etc/ldap.conf, when I login the client by using ssh I will get the "Access denied" message: binddn cn=Manager,dc=mydomain,dc=com bindpw secret The ldap log is the following: May 11 16:08:18 ldapm slapd[24629]: conn=0 fd=13 ACCEPT from IP=192.168.2.161:33801 (IP=0.0.0.0:389) May 11 16:08:18 ldapm slapd[24629]: conn=0 op=0 BIND dn="" method=128 May 11 16:08:18 ldapm slapd[24629]: conn=0 op=0 RESULT tag=97 err=0 text= May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=1 fd=16 ACCEPT from IP=192.168.2.161:33802 (IP=0.0.0.0:389) May 11 16:08:23 ldapm slapd[24629]: conn=1 op=0 BIND dn="" method=128 May 11 16:08:23 ldapm slapd[24629]: conn=1 op=0 RESULT tag=97 err=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=1 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(uid=luke_l)" May 11 16:08:23 ldapm slapd[24629]: conn=1 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= If I have the binddn and bindpw using the distinguished name, Manager, the login will succeed. The ldap log is the following: May 11 17:22:32 ldapm slapd[24629]: conn=20 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=4 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(uid=luke_l)" May 11 17:22:32 ldapm slapd[24629]: conn=20 op=4 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(|(memberUid=luke_l)(uniqueMember=uid=luke_l,ou=people,dc=mydomain,dc=com)))" May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SRCH attr=cn userPassword memberUid uniqueMember gidNumber May 11 17:22:32 ldapm slapd[24629]: <= bdb_equality_candidates: (uniqueMember) not indexed May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=6 UNBIND May 11 17:22:32 ldapm slapd[24629]: conn=20 fd=18 closed May 11 17:22:32 ldapm slapd[24629]: conn=21 fd=16 ACCEPT from IP=192.168.2.161:33816 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=22 fd=18 ACCEPT from IP=192.168.2.161:33817 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 fd=20 ACCEPT from IP=192.168.2.161:33818 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 fd=20 closed (connection lost) What should I do to fix the problem and bind the server anonymously but get the authetication working? Thanks. Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Saturday, May 10, 2008 1:32:58 AM Subject: Re: Mystery - Authentication Would Fail If Not Binding With Server By Using cn=Manager Hi, Luke Lee <leeluke77(a)yahoo.com> writes: > I am running OpenLDAP 2.3.39 on RedHat. My login authentication on a client > system will fail if I don't configure the optional binddn and bindpw by using > cn=Manager. > > Can anyone please enlighten me what could cause the strange problem? Thanks! Could you be a bit more specific and could you provide the access rules of slapd.conf? -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6 ________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Re: Mystery - Authentication Would Fail If Not Binding With Server By Using cn=Manager
by Luke Lee 12 May '08

12 May '08

My access rules in the slapd.conf are the following: access to attrs=userPassword by self write by anonymous auth by dn.base="cn=sysadmin,dc=mydomain,dc=com" write by group.exact="cn=itmanager,ou=manager,dc=mydomain,dc=com" write by * none access to * by self write by dn.base="cn=sysadmin,dc=mydomain,dc=com" write by group.exact="cn=itmanager,ou=manager,dc=mydomain,dc=com" write by * read If I don't have the following entries in a client's /etc/ldap.conf, when I login the client by using ssh I will get the "Access denied" message: binddn cn=Manager,dc=mydomain,dc=com bindpw secret The ldap log is the following: May 11 16:08:18 ldapm slapd[24629]: conn=0 fd=13 ACCEPT from IP=192.168.2.161:33801 (IP=0.0.0.0:389) May 11 16:08:18 ldapm slapd[24629]: conn=0 op=0 BIND dn="" method=128 May 11 16:08:18 ldapm slapd[24629]: conn=0 op=0 RESULT tag=97 err=0 text= May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 16:08:18 ldapm slapd[24629]: conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 16:08:23 ldapm slapd[24629]: conn=0 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=1 fd=16 ACCEPT from IP=192.168.2.161:33802 (IP=0.0.0.0:389) May 11 16:08:23 ldapm slapd[24629]: conn=1 op=0 BIND dn="" method=128 May 11 16:08:23 ldapm slapd[24629]: conn=1 op=0 RESULT tag=97 err=0 text= May 11 16:08:23 ldapm slapd[24629]: conn=1 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(uid=luke_l)" May 11 16:08:23 ldapm slapd[24629]: conn=1 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= If I have the binddn and bindpw using the distinguished name, Manager, the login will succeed. The ldap log is the following:May 11 17:22:32 ldapm slapd[24629]: conn=20 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=4 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(uid=luke_l)" May 11 17:22:32 ldapm slapd[24629]: conn=20 op=4 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixGroup)(|(memberUid=luke_l)(uniqueMember=uid=luke_l,ou=people,dc=mydomain,dc=com)))" May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SRCH attr=cn userPassword memberUid uniqueMember gidNumber May 11 17:22:32 ldapm slapd[24629]: <= bdb_equality_candidates: (uniqueMember) not indexed May 11 17:22:32 ldapm slapd[24629]: conn=20 op=5 SEARCH RESULT tag=101 err=0 nentries=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=20 op=6 UNBIND May 11 17:22:32 ldapm slapd[24629]: conn=20 fd=18 closed May 11 17:22:32 ldapm slapd[24629]: conn=21 fd=16 ACCEPT from IP=192.168.2.161:33816 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=21 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=21 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=luke_l))" May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=18 op=6 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=22 fd=18 ACCEPT from IP=192.168.2.161:33817 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=22 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=22 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 fd=20 ACCEPT from IP=192.168.2.161:33818 (IP=0.0.0.0:389) May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" method=118 May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 BIND dn="cn=Manager,dc=mydomain,dc=com" mech=SIMPLE ssf=0 May 11 17:22:32 ldapm slapd[24629]: conn=23 op=0 RESULT tag=97 err=0 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SRCH base="dc=mydomain,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uidNumber=10022))" May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SRCH attr=uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass May 11 17:22:32 ldapm slapd[24629]: conn=23 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= May 11 17:22:32 ldapm slapd[24629]: conn=23 fd=20 closed (connection lost) What should I do to fix the problem and bind the server anonymously but get the authetication working? Thanks. Luke ----- Original Message ---- From: Dieter Kluenter <dieter(a)dkluenter.de> To: openldap-technical(a)openldap.org Sent: Saturday, May 10, 2008 1:32:58 AM Subject: Re: Mystery - Authentication Would Fail If Not Binding With Server By Using cn=Manager Hi, Luke Lee <leeluke77(a)yahoo.com> writes: > I am running OpenLDAP 2.3.39 on RedHat. My login authentication on a client > system will fail if I don't configure the optional binddn and bindpw by using > cn=Manager. > > Can anyone please enlighten me what could cause the strange problem? Thanks! Could you be a bit more specific and could you provide the access rules of slapd.conf? -Dieter -- Dieter Klünter | Systemberatung http://www.dkluenter.de GPG Key ID:8EF7B6C6 ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

1 0

Any success story using syncRepl with postgresql backend?
by Tommy Ho 12 May '08

12 May '08

I was wondering if anyone had success with using multi-master replication (syncrepl with mirrormode enabled) using postgresql as the backend? I had this working using BDB but when I switched over to use postgres as the backend, the synchronization becomes very erratic and inconsistent, deleted data from one master never gets propagated and newly added data will sometimes get sync'd and sometimes it doesn't. Thanks for any input, \Tommy

2 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical